Analysis
- max time kernel
13s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:21
General
- Target c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba.exe
- Size 463KB
- Sample201113-v1ftjqsjln
- SHA256 c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba
Score
10/10
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.ozsmarthomes.com/iic6/
Decoy
-
screaminyourcarday.com
-
nbhindustriesptyltd.com
-
ntgmfublb.icu
-
bombayracks.com
-
phoenixlights.net
-
rachelamosphotography.com
-
leapforwards.net
-
sendai-salt.com
-
shabbychicflipsbyangelina.com
-
core-ol.com
-
canalysis.net
-
tybeeprohibitiontour.com
-
influencedarts.com
-
italivpn.com
-
newborn.today
-
garagedoorroundrocktx.com
-
participi.com
-
thegoddessnow.com
-
invesito.com
-
surfingnaked.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba.exe"C:\Users\Admin\AppData\Local\Temp\c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba.exe"C:\Users\Admin\AppData\Local\Temp\c59292352ccbebbc63ea3c740a7981594b6e8dbea866e1c1c8f66b0a0aa61eba.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/988-0-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/3804-1-0x0000000000400000-0x000000000042E000-memory.dmp